Lucene search

Veracode Vulnerability DatabaseVERACODE:45790

HistoryMar 07, 2024 - 7:31 a.m.

Cross Site Scripting

2024-03-0707:31:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

jenkins

gitbucket

build views

job configuration

inadequate sanitization

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

org.jenkins-ci.plugins:gitbucket is vulnerable to Cross Site Scripting. The vulnerability is due to inadequate sanitization of GitBucket URLs on build views, allowing attackers with job configuration access to exploit it.

CPENameOperatorVersion
gitbucket pluginle0.8
gitbucket pluginle0.8

CPE	Name	Operator	Version
	gitbucket plugin	le	0.8
	gitbucket plugin	le	0.8

References

www.openwall.com/lists/oss-security/2024/03/06/3

github.com/advisories/GHSA-5j74-g3c5-wqww

www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3249